AN0208: Analytic 0208
Configuration of internal NAT or proxy rules that redirect traffic between client segments internally (e.g., site-to-site port forwarding). Often used to relay internal beaconing or move traffic laterally through trust zones.
Analyst context for executives and security teams
This analytic concerns internal NAT or proxy rules on network devices that redirect traffic between internal client segments, such as site-to-site port forwarding. For leaders, the significance is that routing and forwarding changes can quietly alter trust-zone boundaries and enable traffic relay inside the environment. Even without a provided ATT&CK tactic or detection logic, this behavior is material because it affects segmentation assurance, incident containment, and evidence that network controls are operating as designed.
Executive priority
Prioritize this as a network segmentation and resilience validation issue. Security leaders should ask whether internal NAT/proxy rule changes are governed, logged, reviewed, and tied to approved business use cases. During incidents, unexplained internal forwarding can complicate containment and make it harder to determine which segment is truly isolated. For compliance and audit readiness, the key value is being able to prove that trust-zone traffic paths are intentional, documented, and monitored.
Technical view
SOC, detection engineering, and network security teams should validate visibility into configuration changes and active forwarding behavior on network devices. Because the official object provides no detection text and no related techniques, teams should not assume a ready-made analytic exists. Instead, review whether internal NAT, proxy, and port-forwarding rules can be baselined and whether changes that redirect traffic between client segments generate searchable telemetry. Investigations should focus on unauthorized, newly created, or unusual internal forwarding paths, especially those that bridge zones expected to be segmented.
Likely telemetry
- Network device configuration change logs
- Firewall, router, proxy, or gateway rule audit logs
- NAT and port-forwarding rule tables or configuration snapshots
- Network flow records showing traffic crossing internal segments
- Change-management records for approved network rule modifications
Detection direction
- Baseline approved internal NAT, proxy, and port-forwarding rules on network devices and alert on deviations.
- Correlate rule changes with change tickets, administrator identity, source device, and time of change to reduce false positives from legitimate maintenance.
- Look for new or modified rules that redirect traffic between client segments or bridge trust zones that are normally separated.
- Compare observed network flows with expected segmentation policy; unexpected internal relay paths may indicate a control gap even if no malicious activity is confirmed.
- Account for blind spots where network devices do not export detailed configuration diffs, where logs are overwritten, or where proxy/NAT behavior is only visible in device-local configuration.
Mitigation priorities
- Establish documented ownership and approval workflows for internal NAT, proxy, and port-forwarding rules.
- Restrict administrative access to network devices and ensure privileged changes are attributable to named administrators or controlled service accounts.
- Maintain versioned configuration backups so unauthorized or risky forwarding changes can be identified and rolled back.
- Regularly review segmentation policy against actual device configuration and observed traffic paths.
- Ensure incident response playbooks include validation of internal forwarding rules when investigating lateral movement, internal beaconing, or unexpected cross-segment communications.
Analyst notes and limits
The supplied ATT&CK object is a detection analytic for Network Devices with an official description but no official detection text, no tactics, and no relationship context. This take therefore focuses on defensive validation and governance of internal NAT/proxy forwarding behavior rather than mapping to a specific ATT&CK tactic or claiming a known adversary pattern.
No active exploitation, attribution, specific malware, related ATT&CK techniques, or tested detection logic were supplied. Local device types, logging depth, segmentation design, and change-management data are required to determine practical detection coverage and risk.
Analytic 0208
Configuration of internal NAT or proxy rules that redirect traffic between client segments internally (e.g., site-to-site port forwarding). Often used to relay internal beaconing or move traffic laterally through trust zones.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 7ca27839a156… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0208Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.